RAM authorization-Microservices Engine(MSE)-阿里云帮助中心

Resource Access Management (RAM) is a service provided by Alibaba Cloud to manage user identities and resource access permissions. Using RAM helps you avoid sharing your Alibaba Cloud account keys with other users and allows you to grant users the least privilege access. RAM uses permission policies to define authorizations. This topic describes the general structure of a RAM policy, and the policy statement elements (Action, Resource, and Condition) defined by Enterprise Distributed Application Service for RAM permission policies. The RAM code (RamCode) for Enterprise Distributed Application Service is schedulerx,edas , and the supported authorization granularity is RESOURCE .

General structure of a policy

Permission policies support JSON format with the following general structure:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "<Effect>",
      "Action": "<Action>",
      "Resource": "<Resource>",
      "Condition": {
        "<Condition_operator>": {
          "<Condition_key>": [
            "<Condition_value>"
          ]
        }
      }
    }
  ]
}

The following list describes the fields in the policy:

Version: Specifies the policy version number. It is fixed at 1.
Statement:
- Effect: Specifies the authorization result. Valid values: Allow and Deny.
- Action: Specifies one or more operations that are allowed or denied.
- Resource: Specifies the specific objects affected by the operations. You can use Alibaba Cloud Resource Names (ARNs) to describe specific resources.
- Condition: Specifies the conditions for the authorization to take effect. This field is optional.
  - Condition operator: Specifies the conditional operators. Different types of conditions support different conditional operators.
  - Condition_key: Specifies the condition keys.
  - Condition_value: Specifies the condition values.

Action

The following table lists the actions defined by Enterprise Distributed Application Service. The table's columns are detailed below:

Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.
API: The API that you can call to perform the action.
Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.
Resource type: The type of the resource that support authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.
- For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding ARN in the Resource element of the policy.
- For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.
Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys that are applicable across all RAM-integrated services. For more information, see Common condition keys.
Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

Action	API	Access level	Resource type	Condition key	Dependent action
edas:DeleteSchedulerxRouteStrategyBatch	BatchDeleteRouteStrategy	delete	All Resource ``	None	None
edas:ManageSchedulerxNamespaceModify	UpdateNamespace	update	All Resource ``	None	None
edas:CreateSchedulerxNotificationPolicy	CreateSchedulerxNotificationPolicy	create	All Resource ``	None	None
edas:ManageSchedulerxJobDisable	BatchDisableJobs	update	All Resource ``	None	None
edas:DeleteSchedulerxCalendar	DeleteSchedulerxCalendar	delete	All Resource ``	None	None
edas:ReadSchedulerxNamespaceQuery	ListNamespaces	get	All Resource ``	None	None
edas:GrantSchedulerxRevokePermission	RevokePermission	delete	All Resource ``	None	None
edas:ReadSchedulerxWorkflowQuery	GetWorkflowInstance	get	All Resource ``	None	None
edas:ReadSchedulerxJobInstanceQuery	GetJobInstance	get	All Resource ``	None	None
edas:DeleteSchedulerxAppGroupRemove	DeleteAppGroup	delete	All Resource ``	None	None
edas:ManageSchedulerxWorkflowDagModify	UpdateWorkflowDag	update	All Resource ``	None	None
edas:ManageSchedulerxJobInstStop	StopInstance	update	All Resource ``	None	None
edas:ReadSchedulerxWorkflowQuery	GetWorkFlow	get	All Resource ``	None	None
edas:DeleteSchedulerxRouteStrategyDelete	DeleteRouteStrategy	delete	All Resource ``	None	None
edas:ManageSchedulerxJobSync	ManageSchedulerxJobSync	create	*AppGroup `acs:edas:{#regionId}:{#accountId}:namespace/{#Namespace}/JobGroup/{#GroupId}`	None	None
edas:ReadSchedulerxDesignateInfo	ReadSchedulerxDesignateInfo	get	*AppGroup `acs:edas:{#regionId}:{#accountId}:namespace/{#Namespace}/JobGroup/{#GroupId}`	None	None
edas:ManageSchedulerxWorkflowRun	ExecuteWorkflow	create	All Resource ``	None	None
edas:ReadSchedulerxAppGroupQuery	GetAppGroup	get	All Resource ``	None	None
edas:CreateSchedulerxCalendar	CreateSchedulerxCalendar	create	All Resource ``	None	None
edas:ManageSchedulerxJobInstMarkSuccess	SetJobInstanceSuccess	update	All Resource ``	None	None
edas:ManageSchedulerxWorkflowModify	UpdateWorkflow	update	All Resource ``	None	None
edas:ManageSchedulerxAppGroupModify	UpdateAppGroup	update	All Resource ``	None	None
edas:CreateSchedulerxNamespaceCreate	CreateNamespace	create	All Resource ``	None	None
edas:CreateSchedulerxWorkflowCreate	CreateWorkflow	create	All Resource ``	None	None
edas:DeleteSchedulerxNamespaceDelete	DeleteNamespace	delete	All Resource ``	None	None
edas:ReadSchedulerxDesignateDetail	ReadSchedulerxDesignateDetail	get	*AppGroup `acs:edas:{#regionId}:{#accountId}:namespace/{#Namespace}/JobGroup/{#GroupId}`	None	None
edas:CreateSchedulerxJobCreate	CreateJob	create	All Resource ``	None	None
edas:ManageSchedulerxJobInstRun	RetryJobInstance	none	All Resource ``	None	None
edas:ReadSchedulerxJobQuery	ListJobs	get	All Resource ``	None	None
edas:ManageSchedulerxWorkflowDisable	DisableWorkflow	update	All Resource ``	None	None
edas:ReadSchedulerxJobQuery	GetJobInfo	get	All Resource ``	None	None
edas:ReadSchedulerxJobInstanceQuery	GetJobInstanceList	get	All Resource ``	None	None
edas:DeleteSchedulerxJobDelete	BatchDeleteJobs	delete	All Resource ``	None	None
edas:CreateSchedulerxAppGroupCreate	CreateAppGroup	create	All Resource ``	None	None
edas:ManageSchedulerxJobRerun	RerunJob	none	All Resource ``	None	None
edas:CreateSchedulerxRouteStrategyCreate	CreateRouteStrategy	create	All Resource ``	None	None
edas:ManageSchedulerxJobModify	UpdateJob	update	All Resource ``	None	None
edas:ManageSchedulerxCalendar	ManageSchedulerxCalendar	update	All Resource ``	None	None
edas:ManageSchedulerxJobEnable	BatchEnableJobs	update	All Resource ``	None	None
edas:ReadSchedulerxCalendar	ReadSchedulerxCalendar	list	All Resource ``	None	None
edas:ManageSchedulerxJobModify	UpdateJobScript	update	All Resource ``	None	None
edas:ReadSchedulerxAppGroupQuery	ListGroups	get	All Resource ``	None	None
edas:ManageSchedulerxNotificationPolicy	ManageSchedulerxNotificationPolicy	create	All Resource ``	None	None
edas:DeleteSchedulerxNotificationPolicy	DeleteSchedulerxNotificationPolicy	delete	All Resource ``	None	None
edas:ReadSchedulerxOverviewQuery	GetOverview	get	All Resource ``	None	None
edas:GrantSchedulerxGrantPermission	GrantPermission	create	All Resource ``	None	None
edas:ReadSchedulerxAppGroupQuery	GetWorkerList	get	All Resource ``	None	None
edas:DeleteSchedulerxJobDelete	DeleteJob	delete	All Resource ``	None	None
edas:ManageSchedulerxWorkflowEnable	EnableWorkflow	update	All Resource ``	None	None
edas:ManageSchedulerxDesignateWorkers	DesignateWorkers	create	All Resource ``	None	None
edas:ReadSchedulerxWorkflowQuery	ListWorkflowInstance	get	All Resource ``	None	None
edas:ManageSchedulerxWfInstanceMarkSuccess	SetWfInstanceSuccess	update	All Resource ``	None	None
edas:ReadSchedulerxLogQuery	GetLog	get	All Resource ``	None	None
edas:ReadSchedulerxJobQuery	ListJobScriptHistory	list	All Resource ``	None	None
edas:ManageSchedulerxJobTrigger	ExecuteJob	create	All Resource ``	None	None
edas:ManageSchedulerxJobDisable	DisableJob	update	All Resource ``	None	None
edas:ManageSchedulerxJobEnable	EnableJob	update	All Resource ``	None	None
edas:ReadSchedulerxNotificationPolicy	ReadSchedulerxNotificationPolicy	list	All Resource ``	None	None
edas:DeleteSchedulerxWorkflowDelete	DeleteWorkflow	delete	All Resource ``	None	None
edas:ReadSchedulerxWorkflowQuery	ListWorkFlows	get	All Resource ``	None	None

Resource

The following table lists the resources defined by Enterprise Distributed Application Service. Specify them in the Resource element of RAM policy statements to grant permissions for specific operations. They are uniquely identified by ARNs. Format: acs:{#ramcode}:{#regionId}:{#accountId}:{#resourceType}:

acs: The initialism of Alibaba Cloud service, which indicates the public cloud of Alibaba Cloud.
{#ramcode}: The code used in RAM to indicate an Alibaba Cloud service.
{#regionId}: The region ID. If the resource covers all regions, set it to an asterisk (*).
{#accountId}: The ID of the Alibaba Cloud account. If the resource covers all Alibaba Cloud accounts, set it to an asterisk (*).
{#resourceType}: The service-defined resource identifier. It supports a hierarchical structure, which is similar to a file path. If the statement covers global resources, set it to an asterisk (*).

Resource type	ARN
AppGroup	acs:edas:{#regionId}:{#accountId}:namespace/{#Namespace}/JobGroup/{#GroupId}
WorkFlow	acs:edas:{#regionId}:{#accountId}:*
Job	acs:edas:{#regionId}:{#accountId}:*

Condition

Enterprise Distributed Application Service does not define product-level condition keys. However, you can use Alibaba Cloud common condition keys for access control. For more information, see Common condition keys.

How to create custom RAM policies?

You can create custom policies and grant them to RAM users, RAM user groups, or RAM roles. For instructions, see: